The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions and code explicitly encourage the use of a private key stored in an environment variable (FITTINGS_PRIVATE_KEY). The documentation correctly advises using a 'throwaway wallet', but storing keys in plaintext environment variables is a high-risk practice as they can be leaked via logs, process dumps, or other local files.
[EXTERNAL_DOWNLOADS]: The documentation provides a curl command to download a helper script call.mjs from https://fittings.sh/skill/call.mjs. While this is the vendor's own infrastructure, downloading and executing remote scripts is a capability that should be monitored.
[COMMAND_EXECUTION]: The skill uses node call.mjs to execute a local script that performs network requests and cryptographic signing. It also uses curl and jq for metadata retrieval. These are functional requirements for the skill's purpose but represent an active execution surface.

calc-worksheet